In a remote access (On-Demand) VPN configuration,
users must manually launch the app to establish the secure GlobalProtect
connection. Traffic that matches specific filters (such as port
and IP address) configured on the GlobalProtect gateway is routed
through the VPN tunnel only after users initiate and establish the
connection.

Use the following steps to configure a user-initiated
remote access VPN configuration for iOS endpoints using MobileIron: